An attacker with a local account can exploit a race condition in the Checkmk Windows agent that causes permission changes on the agent’s data directory to be discarded when the service starts. The agent then runs with the permissions of the SYSTEM account. By placing malicious scripts in the agent’s plugin or local folders, the attacker can cause those scripts to execute as SYSTEM, allowing arbitrary code execution. In addition, the attacker can read the private key used by the agent controller, exposing credentials that could compromise the monitoring infrastructure. This vulnerability is characterized by CWE-277, improper restriction of execute-access.

The flaw affects Checkmk installations from Checkmk GmbH running Checkmk in any version prior to 2.5.0p18, 2.4.0p39, or 2.3.0p52, as well as the end‑of‑life version 2.2.0. All affected systems, regardless of the specific configuration, expose their agent data directory to write operations by non‑administrator users during service startup.

The CVSS score of 6.3 indicates a moderate severity, yet the impact is significant because the attacker gains SYSTEM rights locally. The EPSS score is not available, implying limited publicly disclosed exploitation data; however, the vulnerability remains exploitable by any user with local access to the machine running the Checkmk agent. The issue is not listed in CISA’s KEV catalog, so no documented exploits are known. Exploitation requires only local privilege and the ability to write to the agent’s data directory, making it a low‑barrier attack vector for local users.